Skip to main content
Ctrl+K
Logo image Logo image

Intelligence Center 3.3.3 Docs

Site Navigation

  • Release Notes
  • Install Configure Upgrade
  • Get to know EclecticIQ Intelligence Center
  • Work with intelligence
  • Integrations

Section Navigation

  • Command palette
  • View the help
  • About ingestion
  • Tags
  • Generate AI reports
  • Browse
    • Customize list columns
    • Edit entities in Browse
    • Filter entities in Browse
  • Discovery
    • Add entities from the discovery service
    • Customize list columns
    • Edit entities in the Discovery view
    • Export from discovery
  • Exposure
    • About exposure
    • Configure exposure
    • View exposure
    • Edit entities in Exposure
    • Review Exposure
    • Override exposure
    • Customize list columns
  • Production
    • Customize list columns
    • Edit entities in Production
    • Filter entities in Production
  • Rules
    • Entity rules
      • About entity rules
      • Create entity rules
      • Entity rule actions
      • Content criteria tool
      • Manage entity rules
    • Observable rules
      • Create observable rules
      • Manage observable rules
    • Enrichment rules
      • Create enrichment rules
      • Manage enrichment rules
    • Discovery rules
      • Create discovery rules
      • Manage discovery rules
  • Knowledge packs
  • Data mapping templates
  • Search
    • About search
    • Start searching
    • About relational search
    • Search with Kibana
    • Search query syntax
    • Search using tokenizers
    • Sync the search database
  • Filters
    • About filters
    • About source reliability
    • Filter entities by source
    • Filter entities by TLP
    • Filter entities with the histogram
    • Filter entities with timebar
    • Use the context filters
    • Use the quick filters
  • Workspaces
    • About workspaces
    • Access workspaces
    • Default public workspace
    • Create workspaces
    • List and unlist workspaces
    • Add edit and remove entities
    • Add edit and remove datasets
    • Add and remove graphs
    • Collaborate with other users
      • Add collaborators to a workspace
      • Remove collaborators from a workspace
      • Create user tasks
      • View tasks
      • Edit tasks
      • Write and review comments
    • Edit workspaces
    • Archive workspaces
    • Restore workspaces
    • Delete workspaces
    • View workspace history
  • Datasets
    • About datasets
    • Create a dataset
    • Add entities to a dataset
    • Edit entities in a dataset
    • Export from a dataset
    • Edit a dataset
    • Delete a dataset
    • Dataset metrics
  • Graphs
    • About graphs
    • Create a graph
    • Access a graph
    • Add entities to a graph
    • Analyze entities in a graph
    • Group entities in a graph
    • Edit entities in a graph
    • Publish entities in a graph
    • Remove entities from a graph
    • Add relationships to a graph
    • Edit relationships in a graph
    • Publish relationships in a graph
    • Remove relationships from a graph
    • Add observables to a graph
    • Publish observables in a graph
    • Edit observables in a graph
    • Remove observables from a graph
    • Delete observables from a graph
    • Review enrichment observables
    • Move around on the graph
    • Graph on Neighborhood tab
    • Add graph to workspaces
    • Filter entities with the timebar
    • Filter entities with the histogram
    • Toggle visualization layouts
    • Save and export the graph
    • View full titles in the graph
  • Permissions
    • Default Intelligence Center roles
    • Intelligence Center permissions
    • Permissions to access settings
    • Permissions to access data
    • Permissions for public API endpoints
    • Token-based authentication
      • Create an API token
      • Delete an API token
    • Two-factor authentication (2FA)
      • About two-factor authentication
      • Enforce two-factor authentication
      • Set up two-factor authentication
      • Use Do not ask for N days
      • Generate new recovery codes
      • Recover two-factor authentication
      • Disable two-factor authentication
      • Review two-factor authentication activity
  • Users
    • User permissions
    • Manage your own user account
    • Manage users
    • Manage groups
    • Manage roles
    • Manage notifications
    • Manage automation users
    • Export and import user database
  • Policies
    • Account policies
    • Data policies
      • Create data policies
      • Manage data policies

About relational search#

Relational search allows you to search for entities that have specific relationships to other entities.

A relational search query actually consists of three phases:

  1. First, it matches a subset of all the ingested entities to the criteria you set in the “source query”.

  2. Then, it matches another subset of all the ingested entities to the criteria you set in “destination query”.

  3. Lastly, it shows you only the entities that:

    • are in the subset from phase 1, AND

    • have a relationship you choose to at least one entity from the subset in phase 2.



Using relational search#

Tip

Both the Source query field and the Destination querry field support search query syntax.

  1. From the left navigation, select Search icon > Go to Search and Browse.

  2. In the top-left corner, select the dropdown menu > Relational query Relational query.

  3. In the Source query field, define the entities you’re interested in.

  4. From the dropdown menu in the middle, select the relations of interest to you.

    • Select the checkbox if:

      • you only want to include objects directly related to each other.

      • your search returns too many results.

  5. In the Destination query field, define the objects that need to have one of the relations you selected to the first object you defined.

  6. Click the Search icon icon to carry out the query that you’ve built.

Limitations#

Currently, search by relationship has the following limitations:

  • It is available only in the search input field.

  • Relational search queries can return max 5000 matches.

  • Relational search queries look for relationships by analyzing the entities stored in EclecticIQ Intelligence Center.

    They can examine up to max 100 000 items for each entity in the query.

    If a relational search query reaches this upper limit for one or both entities in the query, it stops searching for the entity or entities whose cap is reached.

previous

Start searching

next

Search with Kibana

On this page
  • Using relational search
  • Limitations